Trust Assessment
dns-resolver received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 0 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Potential Command Injection via External Tools.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Potential Command Injection via External Tools The skill explicitly states it 'Uses `dig`, `nslookup`, and `whois`' and provides example `bash` commands. The 'Usage' section implies that user-provided domain names or IP addresses will be incorporated into these commands. If user input is not properly sanitized or escaped before being passed to these shell commands, it could lead to command injection, allowing an attacker to execute arbitrary commands on the host system. For example, input like 'example.com; rm -rf /' could be executed. Ensure all user-provided input (e.g., domain names, IP addresses) is strictly validated and/or properly sanitized/escaped before being used in shell commands. Prefer using libraries that execute external commands safely (e.g., `subprocess.run` with `shell=False` and passing arguments as a list) rather than directly interpolating user input into a shell string. | LLM | SKILL.md:19 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/sa9saq/dns-resolver/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/d2340ab7f70c8dd8)
Powered by SkillShield